From f17eedbd2398f00fbb96170b60c8d2895318223e Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 4 Sep 2025 03:04:44 +0000
Subject: Add more username validity checks

[cjwatson: Reduced from a more extensive upstream change, since OpenSSH
< 10.0 doesn't support %-expansion of usernames.]

Upstream: https://salsa.debian.org/ssh-team/openssh/-/blob/bookworm/debian/patches/CVE-2025-61984-tests.patch
Upstream: https://anongit.mindrot.org/openssh.git/commit/?id=f64701ca25795548a61614d0b13391d6dfa7f38c
CVE: CVE-2025-61984
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 regress/percent.sh | 37 +++++++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/regress/percent.sh b/regress/percent.sh
index 3dfa8d2df..6b9c492b0 100644
--- a/regress/percent.sh
+++ b/regress/percent.sh
@@ -29,6 +29,20 @@ trial()
 		    somehost true
 		got=`cat $OBJ/actual`
 		;;
+	user)
+		got=`${SSH} -F $OBJ/ssh_proxy -o $opt="$arg" -G \
+		    remuser@somehost | awk '$1=="'$opt'"{print $2}'`
+		;;
+	user-l)
+		# Also test ssh -l
+		got=`${SSH} -F $OBJ/ssh_proxy -l "$arg" -G \
+		    somehost | awk '$1=="'user'"{print $2}'`
+		;;
+	user-at)
+		# Also test user@host
+		got=`${SSH} -F $OBJ/ssh_proxy -G "$arg@somehost" | \
+		    awk '$1=="'user'"{print $2}'`
+		;;
 	userknownhostsfile)
 		# Move the userknownhosts file to what the expansion says,
 		# make sure ssh works then put it back.
@@ -107,11 +121,11 @@ done
 
 # Subset of above since we don't expand shell-style variables on anything that
 # runs a command because the shell will expand those.
+FOO=bar
+export FOO
 for i in controlpath identityagent forwardagent localforward remoteforward \
     userknownhostsfile; do
 	verbose $tid $i dollar
-	FOO=bar
-	export FOO
 	trial $i '${FOO}' $FOO
 done
 
@@ -122,3 +136,22 @@ for i in controlpath identityagent forwardagent; do
 	trial $i '~' $HOME/
 	trial $i '~/.ssh' $HOME/.ssh
 done
+
+# These should be not be expanded but rejected for containing shell characters.
+verbose $tid user-l noenv
+${SSH} -F $OBJ/ssh_proxy -l '${FOO}' -G somehost && fail "user-l expanded env"
+verbose $tid user-at noenv
+${SSH} -F $OBJ/ssh_proxy -G '${FOO}@somehost' && fail "user-at expanded env"
+
+FOO=`printf 'x\ay'`
+export FOO
+
+# These should be rejected as containing control characters.
+verbose $tid user-l badchar
+${SSH} -F $OBJ/ssh_proxy -l "${FOO}" -G somehost && fail "user-l expanded env"
+verbose $tid user-at badchar
+${SSH} -F $OBJ/ssh_proxy -G "${FOO}@somehost" && fail "user-at expanded env"
+
+# Literal control characters in config is acceptable
+verbose $tid user control-literal
+trial user "$FOO" "$FOO"